BridgeGuard: Checking External Interaction Vulnerabilities in Cross-Chain Bridge Router Contracts Based on Symbolic Dataflow Analysis

Cross-chain bridges connect two heterogeneous and independent blockchains, in which router contracts interact with external modules to perform functions, e.g., locking assets. However, numerous attacks exploit external interaction vulnerabilities (EIVs) in router contracts. Detecting EIVs presents two key challenges: (1) extracting complete data dependencies, and (2) identifying access controls for off-chain entities. Existing approaches, which transform contracts into intermediate representations for analysis, often miss critical execution logic (e.g., path conditions) and data flows (e.g., data flows at the instruction parameter level). Additionally, the path explosion severely impacts analysis efficiency. In this paper, we systematically analyze real-world attacks and extract the precise features of two typical EIVs. We propose BridgeGuard, a static analysis framework for detecting EIVs. Specifically, we present a symbolic dataflow analysis approach to capture complete execution logic and fine-grained data flows. We then identify three common authentication patterns for off-chain entities and deploy a heuristic-driven pruning method to solve the path explosion. We implement an automated analysis prototype. The experimental results show that for analyzing 1,035 wild contracts with an average scale of 15,914 bytes, BridgeGuard achieves 87.4% average code coverage. For detecting two typical EIVs, BridgeGuard achieves F1-scores above 0.93.